Sunday, June 3, 2007

Missing messages - Part 4

The message was delivered to the mailbox - where did it go?

This is the most common scenario [I mean, speaking as one Exchange Admin to another - what else could it be? ;) ].  As a personal aside, your goal is to figure out what happened and calmly point it out to the user.  The user will likely feel embarrassed already - no need to editorialize or lecture.

As discussed in Part 1, a successful message delivery typically means one of the following:

-  It reached the mailbox and was segregated or deleted by a system function

-  It reached the mailbox and was segregated or deleted by a client function

-  It reached the mailbox and was segregated or deleted by a user function

-  It reached the mailbox and was manually segregated or deleted

System function typically means forwarding configured in AD

To check for forwarding, open the Users & Computers console (ADUC) and open the properties of the recipient's object.  On the Exchange General tab go to Delivery Options.  Any forwarding configured at the Active Directory level will appear there.

Client functions include anti-virus/anti-spam filtering, and directing new messages to a personal folder

Check the console and logs of any 3rd-party anti-virus and anti-spam software.  Check the Junk E-mail folder in the user's mailbox.

Check all workstations this user logs on to for a profile that directs all new messages to a Personal Folder instead of to the mailbox.

User functions include rules, auto-archiving, and viewing filters

Check for and disable any viewing filters in Outlook (View-->ArrangeBy-->Custom)

Check for auto-archiving (File-->Archive), look in all Personal folders listed in the Outlook profile.  Search for all PST files on the local drive and all mapped drives.

Check for rules (Tools-->Rules and Alerts)

If the ruleset is empty, there is still a possibility that something formerly in rules is still acting on messages.  To make sure, close Outlook, then launch it again from a command line using the /cleanrules switch (e.g. outlook.exe /cleanrules)

If the ruleset is not empty and you wish to keep them, you can export the set to a file then import again later.

Remember that the Out Of Office function can also have rules.  If OOO is enabled, make sure you check that configuration for rules.

Manual processes initiated by the user

Look for and search any PST files in the Outlook profile and on the local drive.

Look in the Deleted Items folder.  Look at the Recover Deleted Items area.

Search the other folders for items which were Shift-Deleted.

6 comments:

Vijay said...

You left one more thing to mention.

If the message gets delivered to store and not showing up in the inbox due to a corrupted junk email rule.

When we install IMF on the server, some time the junk rule for some user gets corrupted.

we can run mfcmapi tool to delete that rule and restart the outlook. this should fix the problem

Davis said...

One more item to check. Look at the Junk E-mail Blocked Senders list. Even if "No Automatic Filtering" is selected, if "Permanently delete suspected junk e-mail..." is selected, Outlook will delete email messages from email addresses in the Blocked Senders list.
Great article!

Anonymous said...

Nice brief and this post helped me alot in my college assignement. Gratefulness you seeking your information.

Rob Webb said...

I couldn't see any rules - but starting outlook with the cleanrules switch seems to have unblocked something, and all the missing emails started to appear. Great blog - thanks for taking the time to post it.

Mark Dowling said...

Major kudos. We are a Domino shop transitioning to Exchange and had not locked down Junk by policy, especially "permanently deleted". This blog post saved us from an even longer troubleshooting phase than the hour already spent on it. Needless to say there is a more cautious approach being employed as of this morning!

jsepeta said...

We're running into an issue where a user has 2 desktop pc's, a laptop, and an android phone accessing outlook 2010 messages on an exchange 2007 sp3 server. For some reason, his inbox keeps becoming devoid of messages, and the emptiness gets synced with all devices. sometimes we can login to the web to see all messages, but this is no longer working. When I perform a search in the Exchange recovery console it sees the messages, but there's no obvious way to export them to a PST as I could have done with ExMerge on an unattached edb file.